Heap Overflow Vulnerability in libheif Image Decoder
CVE-2026-84383
Key Information:
- Vendor
Strukturag
- Status
- Vendor
- CVE Published:
- 18 September 2026
Badges
What is CVE-2026-84383?
The vulnerability in libheif, versions prior to 1.23.2, arises from a failure to properly handle crafted HEIF, HEIC, or AVIF item graphs containing nested iden and auxl references. This flaw allows an attacker to trigger a heap out-of-bounds write by exploiting the improper handling of Alpha planes during image decoding. Specifically, the method HeifPixelImage::transfer_channel_from_image_as() may result in duplicate Alpha planes with varying bit depths, leading to erroneous memory allocation and potential exploitation when the heif_decode_image() function processes maliciously constructed files.
Affected Version(s)
libheif >= 1.22.0, < 1.23.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.